From 4b57106a17ade77d1129776f9de646dedb8c326a Mon Sep 17 00:00:00 2001
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Date: Mon, 23 Jul 2012 21:57:02 +0900
Subject: [PATCH] Check sum of file length does not exceed INT64_MAX

With BitTorrent or Metalink (metaurl), one RequestGroup can contain
multiple files. In this change, ensure that the sum of thoese files
must be equal or less than INT64_MAX.
---
 src/Metalink2RequestGroup.cc | 5 +++++
 src/bittorrent_helper.cc     | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/src/Metalink2RequestGroup.cc b/src/Metalink2RequestGroup.cc
index a01aae98..b266cd77 100644
--- a/src/Metalink2RequestGroup.cc
+++ b/src/Metalink2RequestGroup.cc
@@ -57,6 +57,7 @@
 #include "download_helper.h"
 #include "fmt.h"
 #include "SegList.h"
+#include "DownloadFailureException.h"
 #ifdef ENABLE_BITTORRENT
 # include "BtDependency.h"
 # include "download_helper.h"
@@ -313,6 +314,10 @@ Metalink2RequestGroup::createRequestGroup
         }
         fe->setOriginalName((*i)->metaurls[0]->name);
         fileEntries.push_back(fe);
+        if(offset >
+           std::numeric_limits<int64_t>::max() - (*i)->file->getLength()) {
+          throw DOWNLOAD_FAILURE_EXCEPTION(fmt(EX_TOO_LARGE_FILE, offset));
+        }
         offset += (*i)->file->getLength();
       }
       dctx->setFileEntries(fileEntries.begin(), fileEntries.end());
diff --git a/src/bittorrent_helper.cc b/src/bittorrent_helper.cc
index 46d6109c..b6fc89b7 100644
--- a/src/bittorrent_helper.cc
+++ b/src/bittorrent_helper.cc
@@ -248,6 +248,9 @@ void extractFileEntries
         throw DL_ABORT_EX2(fmt(MSG_MISSING_BT_INFO, C_LENGTH.c_str()),
                            error_code::BITTORRENT_PARSE_ERROR);
       }
+      if(length > std::numeric_limits<int64_t>::max() - fileLengthData->i()) {
+        throw DOWNLOAD_FAILURE_EXCEPTION(fmt(EX_TOO_LARGE_FILE, length));
+      }
       length += fileLengthData->i();
       if(fileLengthData->i() > std::numeric_limits<off_t>::max()) {
         throw DOWNLOAD_FAILURE_EXCEPTION(fmt(EX_TOO_LARGE_FILE, length));